security patches against 4_0_5
| From: | Romolo Manfredini | Date: | Tue, 27 Mar 2001 14:15:33 +0000 |
| Subject: | security patches against 4_0_5 | ||
| Groups: | php.qa | ||
| Request: | Send a blank email to php-qa+get-2659@lists.php.net to get a copy of this message | ||
Does someone see problems in merging the following patches in 4_0_5
They patch two serius problems in 4_0_5
copy function:
the safe mode check, checks only ownership of source, then it call php_copy_file, so if the httpd
process have OS right to open the target file, any user can overwrite a file writable by httpd with
a file owned by himself.
move_uploaded_file
similar problem as user can overwrite any file with the uploaded one.
waiting for comments.
Romolo Manfredini
Attachment: [application/octet-stream] diff
Attachment: [application/octet-stream] diff